Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:124619
Feedback-ID: ifab94697:Fastmail
User-Agent: Cyrus-JMAP/3.11.0-alpha0-582-g5a02f8850-fm-20240719.002-g5a02f885
Precedence: bulk
MIME-Version: 1.0
Message-ID: <87f6eaed-e07e-45a5-abd0-19c3152fe818@app.fastmail.com>
In-Reply-To: <B4AAB40D-61C3-4710-A917-1F444200DC12@rwec.co.uk>
References: 
 <USzt7tZZlO1DmAbSTLhD-bqa23FqZn0zk2aah8Ndxgk9c7RY5PefQ8MjbYPUYAzr2_m4Cf-5AI4PuNBTS84rim_FNS6RaT-cWSv714HEvvU=@gpb.moe>
 <1a88918e-e808-d778-45e1-53797660e093@php.net>
 <CAPrKfG5Cw_nU7g7FR+t4C1-YZ8CDsDO_-sRs=yEsHO5kCTZL+A@mail.gmail.com>
 <c03eb187-bd21-4a4b-9faf-8d0243eaa994@varteg.nz>
 <aa6bc7aa-28d9-40ca-974f-65075adb6199@rwec.co.uk>
 <9041cba85d6439682bb44fcb29210c944dbe3911.camel@ageofdream.com>
 <66A2D544.5060801@adviesenzo.nl>
 <e5379886fefbd0485e7b3ef488e8bf790b2c575e.camel@ageofdream.com>
 <B4AAB40D-61C3-4710-A917-1F444200DC12@rwec.co.uk>
Date: Fri, 26 Jul 2024 16:47:52 +0200
To: internals@lists.php.net
Subject: Re: [PHP-DEV] [RFC] [VOTE] Deprecations for PHP 8.4
Content-Type: multipart/alternative;
 boundary=efaf06c36ddd44e3bfea1cd3910fe022
From: rob@bottled.codes ("Rob Landers")

--efaf06c36ddd44e3bfea1cd3910fe022
Content-Type: text/plain;charset=utf-8
Content-Transfer-Encoding: quoted-printable



On Fri, Jul 26, 2024, at 08:44, Rowan Tommins [IMSoP] wrote:
>=20
>=20
> On 25 July 2024 23:54:53 BST, Nick Lockheart <lists@ageofdream.com> wr=
ote:
> >Doesn't password_hash() handle this automatically? The result of the
> >password_hash() function includes the hash and the algorithm used to
> >hash it. That way password_verify() magically works with the string
> >that came from password_hash().
>=20
> For password hashing, you are always retrieving the hash for a specifi=
c user, and then making a yes/no decision about it. Indeed, it's an expl=
icit aim that an attacker can't take a password and quickly scan a captu=
red database for matching hashes.

You=E2=80=99d be surprised how many projects get this wrong and claim it=
 isn't a security issue. If you can get the hashes, you likely have the =
ability to run arbitrary sql commands and since password_hash stores the=
 salt right in the hash, you just need to crack one easy to guess passwo=
rd -- or just run password_hash on your machine ... then copy it to what=
ever user you want to login as. Very few php projects salt the passwords=
 with something application/user specific (see: symfony's legacy passwor=
d implementation which does, and new one which does not; and yes I repor=
ted it, and yes, it "isn't a security issue") to prevent this from happe=
ning.

There are other bad defaults, such as pdo_mysql allowing more than one s=
ql statement (but all other drivers not -- and mysqli is also not)... ma=
king it even easier to open yourself up to getting hacked if you use pdo=
 with mysql; allowing a single injection to be used to insert/update or =
even drop tables.

Security is something hard to get right, for any language and framework.=
 PHP isn't an exception here; you have to pay attention to what you are =
doing and think like an attacker, every step of the way.

>=20
> For other uses of hashes, though, the opposite is true: you want to se=
arch for matching hashes. For instance, when you store a file in git, it=
 calculates the SHA1 hash of its content to use as a lookup key. If that=
 key already exists in the local database, it assumes the content is the=
 same.
>=20
> That also demonstrates another difference: hashes are often shared bet=
ween applications, where they need to be using an agreed algorithm. If a=
 package manager requires SHA1 hashes of each file, you can't just subst=
itute SHA256 hashes without some other agreed changes.
>=20
> Tempting though a "secure_hash" function is, I don't think it's practi=
cal for a lot of the places hashing is used.

I think we can borrow from a recent RFC to return more than one thing:

secure_hash($data, $algorithm =3D null): [$algorithm, $hash, $updated_al=
gorithm, $updated_hash];

if you pass in an algorithm, it has to have been considered "secure" wit=
hin the last two major versions*, it also returns an optional "updated" =
part, where it can be used to update the hash in your database, if neede=
d.

=E2=80=94 Rob
--efaf06c36ddd44e3bfea1cd3910fe022
Content-Type: text/html;charset=utf-8
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE html><html><head><title></title><style type=3D"text/css">p.Mso=
Normal,p.MsoNoSpacing{margin:0}
p.MsoNormal,p.MsoNoSpacing{margin:0}
p.MsoNormal,p.MsoNoSpacing{margin:0}</style></head><body><div><br></div>=
<div><br></div><div>On Fri, Jul 26, 2024, at 08:44, Rowan Tommins [IMSoP=
] wrote:<br></div><blockquote type=3D"cite" id=3D"qt" style=3D""><div><b=
r></div><div><br></div><div>On 25 July 2024 23:54:53 BST, Nick Lockheart=
 &lt;<a href=3D"mailto:lists@ageofdream.com">lists@ageofdream.com</a>&gt=
; wrote:<br></div><div>&gt;Doesn't password_hash() handle this automatic=
ally? The result of the<br></div><div>&gt;password_hash() function inclu=
des the hash and the algorithm used to<br></div><div>&gt;hash it. That w=
ay password_verify() magically works with the string<br></div><div>&gt;t=
hat came from password_hash().<br></div><div><br></div><div>For password=
 hashing, you are always retrieving the hash for a specific user, and th=
en making a yes/no decision about it. Indeed, it's an explicit aim that =
an attacker can't take a password and quickly scan a captured database f=
or matching hashes.<br></div></blockquote><div><br></div><div>You=E2=80=99=
d be surprised how many projects get this wrong and claim it isn't a sec=
urity issue. If you can get the hashes, you likely have the ability to r=
un arbitrary sql commands and since password_hash stores the salt right =
in the hash, you just need to crack one easy to guess password -- or jus=
t run password_hash on your machine ... then copy it to whatever user yo=
u want to login as. Very few php projects salt the passwords with someth=
ing application/user specific (see: symfony's legacy password implementa=
tion which does, and new one which does not; and yes I reported it, and =
yes, it "isn't a security issue") to prevent this from happening.<br></d=
iv><div><br></div><div>There are other bad defaults, such as pdo_mysql a=
llowing more than one sql statement (but all other drivers not -- and my=
sqli is also not)... making it even easier to open yourself up to gettin=
g hacked if you use pdo with mysql; allowing a single injection to be us=
ed to insert/update or even drop tables.<br></div><div><br></div><div>Se=
curity is something hard to get right, for any language and framework. P=
HP isn't an exception here; you have to pay attention to what you are do=
ing and think like an attacker, every step of the way.<br></div><div><br=
></div><blockquote type=3D"cite" id=3D"qt" style=3D""><div><br></div><di=
v>For other uses of hashes, though, the opposite is true: you want to se=
arch for matching hashes. For instance, when you store a file in git, it=
 calculates the SHA1 hash of its content to use as a lookup key. If that=
 key already exists in the local database, it assumes the content is the=
 same.<br></div><div><br></div><div>That also demonstrates another diffe=
rence: hashes are often shared between applications, where they need to =
be using an agreed algorithm. If a package manager requires SHA1 hashes =
of each file, you can't just substitute SHA256 hashes without some other=
 agreed changes.<br></div><div><br></div><div>Tempting though a "secure_=
hash" function is, I don't think it's practical for a lot of the places =
hashing is used.<br></div></blockquote><div><br></div><div>I think we ca=
n borrow from a recent RFC to return more than one thing:<br></div><div>=
<br></div><div>secure_hash($data, $algorithm =3D null): [$algorithm, $ha=
sh, $updated_algorithm, $updated_hash];<br></div><div><br></div><div>if =
you pass in an algorithm, it has to have been considered "secure" within=
 the last two major versions*, it also returns an optional "updated" par=
t, where it can be used to update the hash in your database, if needed.<=
br></div><div><br></div><div id=3D"sig121229152">=E2=80=94 Rob<br></div>=
</body></html>
--efaf06c36ddd44e3bfea1cd3910fe022--